Spain’s health system has quietly gone mobile, but the experience is far from uniform. For residents who want to book appointments, check test results, or pick up medication without a plastic card, the smartphone is now a viable gateway. The same holds for travelers and people relocating between regions who wonder which medical data follows them. The short answer: the virtual health card carries full legal validity across the entire National Health System (SNS), electronic prescriptions can be filled in pharmacies in other regions, and clinical reports are shared between regional health services—with privacy controls that patients themselves can activate.
- Legal parity: Royal Decree 922/2024, in force since 19 September 2024, gives the virtual health card the same validity as the physical one anywhere in the SNS.
- Interoperable prescription: Medication prescribed electronically in one region can be dispensed at any pharmacy nationwide by presenting only the health card.
- Patient-controlled privacy: Through the Digital Clinical History of the SNS, users can hide documents, review who accessed their records, and file complaints about unjustified access.
What does not exist is a single, unified app. Each autonomous community runs its own application, with different features and access requirements.
Virtual Card: Same Rights, Different Rollouts
The legal foundation is clear. Article 2 of Royal Decree 922/2024 states that the health card, whether physical or virtual, is valid throughout the SNS and has identical validity regardless of format. Three nuances matter. First, regions may issue the virtual version but are not obliged to—they can offer only the physical card or both. Second, when both exist, the virtual one can replace the physical only with the holder’s consent. Third, the virtual card must include a QR code carrying the same standardized data as the magnetic stripe, so any center or pharmacy can read it. The decree gave regions 18 months from its entry into force—until March 2026—to adapt existing virtual cards to these interoperability requirements.
Andalusia illustrates how this has been applied. According to the regional government, its virtual health card has been available since 26 March 2026 for residents with public coverage, with no age limit (under-18s need Cl@ve). It is activated through the Salud Andalucía app, the ClicSalud+ website, or the Carpeta Ciudadana portal, and generates a dynamic QR code valid for 24 hours that serves for identification at health centers and for collecting medication at pharmacies, including in other regions.
What Each Regional App Actually Does
The common core is booking appointments, viewing reports and test results, checking medication and vaccinations—but the catalog varies widely. Three official examples show the differences.
Catalonia: La Meva Salut. According to CatSalut, the app lets users consult and download reports, diagnoses, and test results, view the current medication plan, book appointments at primary care centers, check surgical waiting lists, review vaccinations, access advance directives, and conduct non-face-to-face consultations via eConsulta. Users must be at least 16 years old (the health majority age) and hold a health card. CatSalut is gradually phasing out new passwords in favor of idCAT Mòbil, digital certificates, or, soon, Cl@ve. Those still logging in with a password receive a five-digit code by SMS as a second factor—better than nothing, though SMS has known weaknesses as a second factor.
Madrid: Tarjeta Sanitaria Virtual and Cita Sanitaria Madrid. The virtual card app is for users of the Madrid Health Service over 16 and is activated with a digital certificate, electronic ID, permanent Cl@ve, the IDentifica system, or in person with a QR code. It includes a notice inbox, management of primary and hospital appointments, and a delegated card feature with three levels for managing someone else’s card. For appointments, there is also the free Cita Sanitaria Madrid app, which lets users save multiple people and export appointments to the phone’s calendar.
Andalusia: Salud Andalucía and ClicSalud+. Beyond the virtual card, ClicSalud+ allows users to request a replacement physical card for loss, theft, or damage by identifying themselves with a certificate, electronic ID, or Cl@ve; the replacement arrives by mail in about 15 days, according to the regional government. Salud Responde is the telephone support line the regional government directs users to for card-related questions.
For those without Cl@ve or a digital certificate, obtaining one unlocks nearly all these apps and the Carpeta Ciudadana portal, which also centralizes electronic notifications from public administrations.
Falling Ill or Needing Medication in Another Region
Prescriptions can be dispensed at any pharmacy in the country, and clinical reports can be consulted from another health service. These are two distinct state-level systems coordinated by the Ministry of Health.
The interoperable electronic prescription of the SNS, according to the Ministry of Health, allows patients to collect medication prescribed electronically in one region at a pharmacy in any other, presenting only the health card. It includes useful services few people know about: canceling a dispensing within 24 hours, having the pharmacist provisionally block a medication if a risk is detected, or requesting confidentiality in the prescription so that a drug is only visible and dispensed if a code is provided.
The Digital Clinical History of the SNS (HCDSNS) is the system that lets regions share relevant clinical information so it is available in any regional service, at the citizen’s request. The ministry assigns it three goals: avoiding repeat tests, enabling access regardless of where the information was generated, and restricting consultation to authorized professionals—while also letting patients know who has accessed their records.
That last point is in patients’ hands. According to the ministry’s frequently asked questions, users log in through their regional health service website using an electronic ID, certificate, or Cl@ve, and from there they can:
- Hide any document with the corresponding button. Hiding is reversible, and the system warns that in certain circumstances a professional may access it in emergency mode.
- Check the access log to see who has opened their documents.
- File a complaint about access considered unjustified, using a form that generates an acknowledgment of receipt.
If a report is missing, the ministry lists several possible reasons: it predates computerization, it remains in the center’s local system, the region has not yet published it, or it belongs to a document type the health service does not yet offer. And for everything an entity holds about a person, the GDPR right of access remains available step by step.
The invisible infrastructure works better than the visible layer. Interoperable prescriptions and shared clinical histories solve real problems for travelers and people who relocate, and the access log is a control tool few systems offer. What grates is the fragmentation of the user-facing side: a different app in each region, access requirements ranging from SMS to digital certificates, and a virtual card that the law permits but does not impose. If your region offers it, activate it. If not, at least log into your clinical history once and check the access log—it is the fastest way to confirm that your health data sits where it should and in the right hands.